A compromised AI agent that continues using delegated privileges to perform harmful actions after trust has been broken. The term captures the operational reality that the agent may still look functional while acting as a remote execution or exfiltration channel.
Expanded Definition
Zombie AI is a security term for an AI agent that remains operational after compromise, policy failure, or trust revocation, while still retaining enough delegated authority to carry out actions. In practice, the agent may continue to call tools, access data, send messages, or trigger workflows even though it should no longer be trusted. That makes it different from a simple malfunctioning model: the defining issue is not prediction quality, but continued execution authority after the security boundary has been broken.
Usage of the term is still evolving across the industry, and definitions vary across vendors and research teams. At NHIMG, the most useful reading is operational rather than academic: the “zombie” state begins when an agent’s identity, tokens, or control plane relationship are no longer trustworthy, yet the agent still appears healthy to monitoring systems. This is closely aligned with the governance intent of the NIST Cybersecurity Framework 2.0, especially where active services and credentials must be contained after compromise.
The most common misapplication is treating zombie AI as an uptime problem, which occurs when teams focus on service availability instead of revoking tool access, credentials, and orchestration permissions after a trust event.
Examples and Use Cases
Implementing detection and containment for zombie AI rigorously often introduces response friction, requiring organisations to weigh rapid automation against tighter revocation and approval controls.
- An agentic customer support system is phished through a poisoned connector, then continues issuing refund approvals because its service token was not revoked.
- A coding assistant with repository write access is repurposed after prompt injection and starts opening pull requests that insert malicious dependencies.
- A procurement agent retains API keys to financial systems after the owning workflow is decommissioned, but still posts purchase requests and status updates.
- A SOC automation bot continues forwarding logs to an external endpoint after the trust model changes, creating an exfiltration path that looks like normal telemetry.
For identity-heavy deployments, the relevant question is not whether the model is still producing outputs, but whether its delegated OWASP guidance for LLM and agent risk still permits meaningful actions. A zombie AI can preserve the outward signs of service while losing the legitimacy of the identity behind it.
Why It Matters for Security Teams
Zombie AI matters because compromise is often detected too late for reactive containment to be clean. Once an agent has been granted broad tool access, a broken trust relationship can turn a single automation into a durable execution channel. Security teams need to think in terms of delegated authority, session lifetime, and revocation path, not just model safety or content filtering. That is especially important where the agent is backed by machine credentials, long-lived API keys, or privileged workflow integrations.
This term sits at the intersection of AI security and identity governance. If the agent’s identity is not bound to narrow, auditable, and revocable permissions, then post-compromise cleanup becomes far harder than classic account disablement. The operational goal is to make sure an agent cannot keep acting simply because it is still online or still returning plausible outputs. The OWASP agentic AI and LLM risk guidance is useful here because it frames tool misuse, excessive agency, and unsafe orchestration as real attack surfaces.
Organisations typically encounter the full impact only after suspicious actions have already propagated through systems, at which point zombie AI containment becomes operationally unavoidable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-1 | Access control and identity management frame revocation after compromise. |
| NIST AI RMF | AI RMF addresses governance, oversight, and monitoring of AI system behavior. | |
| OWASP Agentic AI Top 10 | OWASP agentic guidance covers excessive agency and tool misuse risks. | |
| OWASP Non-Human Identity Top 10 | NHI guidance applies when agents use machine identities and persistent secrets. | |
| NIST SP 800-63 | AAL2 | Digital identity assurance informs how strongly an agent credential is trusted. |
Set assurance expectations for agent credentials and retire them quickly on compromise.
